Failed Login For a Long Username With Special Characters
Synopsis
Field
Value
Activation Period
14 Days
Training Period
30 Days
Test Period
N/A (single event)
Deduplication Period
1 Day
Required Data
Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR XDR Agent
ATT&CK Tactic
Initial Access (TA0001)
ATT&CK Technique
Exploit Public-Facing Application (T1190)
Severity
Informational
Description
A long username containing special characters failed to log in to the domain.
Attacker's Goals
An attacker is trying to get code execution on internet-facing assets through command injection.
Investigative actions
Check the host and/or user triggering these failed attempts:
Is the host running internet-facing services?
Are we looking at sanction vulnerability scanning?
Was this helpful?